Navigating Data Privacy for GenAI in Customer Support

As the adoption of generative AI (GenAI) accelerates across enterprises, one of the most promising applications emerges in customer support. GenAI enables automated responses, allowing businesses to engage in natural conversations with customers and provide real-time chat support. However, this convenience comes with inherent risks, particularly concerning data privacy.

The Challenge: Sensitive Data in Customer Support

Imagine this scenario: A customer seeks assistance with a hotel booking. In the course of the conversation, they might share sensitive information such as credit card details or their date of birth. In line with this, sensitive information may also be required as context to correctly troubleshoot the issue.

GenAI can be helpful in automating responses to provide frontline support to customers before escalating to a human. GenAI can also serve as a co-pilot to human support agents to help them find information and draft responses to customers more quickly. As a result, GenAI can meaningfully increase the productivity of a support team and, ultimately, provide better support.

While GenAI can automate responses and scale the ability to provide high-quality support, it also processes and generates data, including personal information. Here lies the challenge: How can we ensure data privacy while leveraging GenAI?

The Risk Landscape: Areas to Address

AI is everywhere; it’s important to understand and mitigate the risks of using GenAI before deploying it widely. Here are two prominent risks associated with GenAI:

1. Third-party APIs and services: Many GenAI applications rely on third-party APIs or services, such as the OpenAI API. When customers share sensitive data, it flows downstream to these external services. These services may store or leverage this data, depending on their agreements and practices.
2. Compliance: Regulations such as the General Data Protection Regulation (GDPR) mandate that organizations handle personal data responsibly. As GenAI processes and generates data, it becomes crucial to align with compliance requirements.

The Solution: Safeguarding Sensitive Data

Nightfall AI, an AI-native Data Leak Prevention (DLP) platform, steps in to address these concerns. Here’s how it works:

User input

The client application processes user input. For example, the application may be a customer support portal, and the user has submitted a new ticket requesting help with their hotel booking.

For example, let’s say the user inputs the following: “My credit card number is 4916-6734-7572-5015 and the card is getting declined.”

Sensitive data detection

Next, the client application sends the user-generated content to the Nightfall service via API calls to be scanned. Nightfall’s APIs analyze arbitrary text or files, identifying sensitive elements like credit card numbers, API keys, and other confidential information.

In our example, Nightfall identifies that the user input payload contains a credit card number: 4916-6734-7572-5015.

Data protection

Once sensitive data is detected in the input payload, Nightfall offers multiple protective measures:

• Redaction: Sensitive portions are masked or redacted to ensure that they don’t reach downstream services.
• Encryption: Data elements can be encrypted to add an extra layer of security.
• Masking: Sensitive values are replaced with placeholders or synthetic variants in order to maintain context while safeguarding privacy.

Nightfall’s APIs return this protected/modified data back to the client application. In our example, Nightfall returns: “My credit card number is [REDACTED] and the card is getting declined.”

Integration with GenAI services

Nightfall acts as a client wrapper, and bridges the gap between customer interactions and GenAI APIs. By scrubbing out sensitive data, it ensures that only sanitized information reaches the AI models. After the data is scanned by Nightfall, the client application can construct the prompt to the AI model using the redacted user-generated content. This sanitized prompt can then be sent downstream to GenAI services via their respective APIs, like the OpenAI API.

For example, the client application can construct the AI prompt: “The customer said: 'My credit card number is [REDACTED] and the card is getting declined.' How should I respond to the customer?”

The AI model will then return back the generated response to the client application. The sensitive information was not necessary for the model to respond correctly.

Learn more about how to implement Nightfall’s Firewall for AI as a content filter for LLM inputs/outputs by reviewing our tutorial here.

The Details: Nightfall's Firewall for AI

Here are some key benefits of using Nightfall's comprehensive data protection platform to safeguard your data from GenAI:

• Continuous compliance: Nightfall helps organizations stay compliant by preventing sensitive data from flowing unchecked.
• Reduced risk: By proactively detecting and protecting sensitive data, Nightfall minimizes the risk of breaches.
• Enhanced productivity: Nightfall unlocks the ability to safely leverage GenAI more heavily in cost-intensive workflows like customer support.

The Conclusion

As GenAI transforms customer support, data privacy remains paramount. With a solution like Nightfall's Firewall for AI, enterprises can confidently embrace automation while safeguarding sensitive information.